Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1684060
| From | Michal Hocko <mhocko@kernel.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [RFC][PATCH] exec: Use init rlimits for setuid exec |
| Date | 2017-07-10 10:50 +0200 |
| Message-ID | <u1Cye-2Hm-15@gated-at.bofh.it> (permalink) |
| References | <u06K5-7OK-1@gated-at.bofh.it> <u0hYS-819-19@gated-at.bofh.it> <u0iLg-7d-15@gated-at.bofh.it> <u0jei-gY-25@gated-at.bofh.it> <u0ktH-1dP-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Thu 06-07-17 12:12:55, Kees Cook wrote:
> On Thu, Jul 6, 2017 at 10:52 AM, Linus Torvalds
> <torvalds@linux-foundation.org> wrote:
> > On Thu, Jul 6, 2017 at 10:29 AM, Kees Cook <keescook@chromium.org> wrote:
> >>>
> >>> (a) minimal: just use our existing default stack (and stack _only_)
> >>> limit value for suid binaries that actually get extra permissions: {
> >>> _STK_LIM, RLIM_INFINITY }.
> >>
> >> This would look a lot like the existing patch; it'd just not copy the
> >> init process rlimits.
> >
> > Can't we just do the final rlimit setting so late in execve that we
> > don't need that whole "saved_rlimit" thing?
>
> The stack rlimit defines the mmap layout too:
>
> do_execveat_common() ->
> exec_binprm() ->
> search_binary_handler() ->
> fmt->load_binary (load_elf_binary()) ->
> setup_new_exec() ->
> arch_pick_mmap_layout() ->
> mmap_is_legacy() ->
> rlimit(RLIMIT_STACK) == RLIM_INFINITY
FWIW this is gone in tip tree. See
lkml.kernel.org/r/20170614082218.12450-1-mhocko@kernel.org
--
Michal Hocko
SUSE Labs
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-06 06:40 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-06 07:00 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec ebiederm@xmission.com (Eric W. Biederman) - 2017-07-06 15:00 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-06 17:30 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Willy Tarreau <w@1wt.eu> - 2017-07-06 07:50 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec ebiederm@xmission.com (Eric W. Biederman) - 2017-07-06 14:50 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-06 17:40 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-06 18:40 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-06 19:00 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-06 19:30 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-06 20:00 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-06 21:20 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-07 06:50 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 07:10 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 07:20 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 07:40 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 07:50 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 08:50 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 18:30 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 20:30 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-07 07:40 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 07:50 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 08:10 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 08:20 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 18:10 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 20:30 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-07 17:00 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 07:20 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Michal Hocko <mhocko@kernel.org> - 2017-07-10 10:50 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-10 18:20 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Willy Tarreau <w@1wt.eu> - 2017-07-10 19:00 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-10 18:20 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Michal Hocko <mhocko@kernel.org> - 2017-07-10 18:30 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Michal Hocko <mhocko@kernel.org> - 2017-07-10 20:20 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Rik van Riel <riel@redhat.com> - 2017-07-10 20:40 +0200
Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-07-13 02:00 +0200
csiph-web